streamline demo with CycloneDX/sbom-examples

[jkowalleck]

there is a repo https://github.com/CycloneDX/sbom-examples it hosts example output of this project as https://github.com/CycloneDX/sbom-examples/tree/master/laravel-7.12.0

there s a demo project for cyclonedx-php-composer: https://github.com/CycloneDX/cyclonedx-php-composer/tree/master/demo

goal: stream line both of them:

• [x] adjust cyclonedx-php-composer's demo to produce the results for https://github.com/CycloneDX/sbom-examples/tree/master/laravel-7.12.0
  • might not be done completely correct. see discussion in this issue below
• [x] link with https://github.com/CycloneDX/sbom-examples/tree/master/laravel-7.12.0
• [x] update https://github.com/CycloneDX/sbom-examples/tree/master/laravel-7.12.0
  • update XML
  • add JSON
  • cross-link cyclonedx-php-composer's demo with https://github.com/CycloneDX/sbom-examples/tree/master/laravel-7.12.0
  • :100: PR: https://github.com/CycloneDX/sbom-examples/pull/8
• [x] dependabot must ignore demo dir
• [x] reproducible tests check that SBOM output for XML files did not change
• [x] reproducible tests check that SBOM output for JSON files did not change

---

demo project and reproducible outcome is available here: https://github.com/CycloneDX/cyclonedx-php-composer/tree/master/demo/laravel-7.12.0

[coderpatros]

That’s a great idea. Looking forward to see how you tackle this. I should do the same for the .NET implementation.

[jkowalleck]

@coderpatros i did a demo setup before, since i found the tests insufficient. I did not want to improve the tests, since i am working on a unit-tested rewrite already. So i came up with a demo as some kind of end-t-end integration test.

this exciting demo was runable in every supported env, but therefore it's output SBOM files were not reproducible.

SO via #59 + #66 is added the demo with thee needed laravel/laravel:7.12.0 as a reproducible setup.

Since i am pinning to outdated versions in my demo, i still need to get dependabot to ignore these demo files. this was tried to do via via #60 and #63(important - see #61) without some affect:

• dependencies still are listed and marked as vulnerable - https://github.com/CycloneDX/cyclonedx-php-composer/network/dependencies.
  • denependabot ignores those dependencies as expected - https://github.com/CycloneDX/cyclonedx-php-composer/network/updates
  • vulnerable dep "laravel:7.12: is ignored by dependabot alerts as expected - https://github.com/CycloneDX/cyclonedx-php-composer/security/dependabot
  • result: this repo does not prompt as vulnerable, demo deps are not managed by dependabot.

[jkowalleck]

@coderpatros i wonder if i tackeled this right.

the idea: i want to have reproducible builds. therefor i need a composer.lock file. since https://github.com/laravel/laravel/tree/v7.12.0 did not have one.

i creeated a demo project that requires laravel/framework:7.12.0 - seamed far enough for me .... then i pinned the dependencies, to keep track of the versions so i get reproducible SBOM files.

anyways, i decided to require the whole laravel via #66

[jkowalleck]

@coderpatros addendum: added CI tests to check that reproducible files are produced without changes - via #70

[jkowalleck]

all done